List virtual accounts

curl --request GET \
  --url https://api.bitnob.com/api/virtual-accounts \
  --header 'X-Auth-Client: <api-key>' \
  --header 'X-Playground-Client-Secret: <api-key>'

const options = {
  method: 'GET',
  headers: {'X-Auth-Client': '<api-key>', 'X-Playground-Client-Secret': '<api-key>'}
};

fetch('https://api.bitnob.com/api/virtual-accounts', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.bitnob.com/api/virtual-accounts"

headers = {
    "X-Auth-Client": "<api-key>",
    "X-Playground-Client-Secret": "<api-key>"
}

response = requests.get(url, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.bitnob.com/api/virtual-accounts",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-Auth-Client: <api-key>",
    "X-Playground-Client-Secret: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.bitnob.com/api/virtual-accounts"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Auth-Client", "<api-key>")
	req.Header.Add("X-Playground-Client-Secret", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "data": {
    "page_info": {
      "has_next_page": false,
      "has_previous_page": false,
      "total": 1
    },
    "virtual_accounts": [
      {
        "account_alias": "Acme Logistics Ltd",
        "account_name": "Acme Logistics Ltd",
        "account_number": "9900000000",
        "account_type": "business",
        "bank_name": "Sandbox Bank",
        "company_id": "019a3b5c-1a2b-7c3d-8e4f-5a6b7c8d9e01",
        "created_at": "2026-09-02T11:21:00Z",
        "currency": "NGN",
        "id": "019a3b5e-0a1b-7c2d-8e3f-4a5b6c7d8e01",
        "reference": "company-va-019a3b5c-1a2b-7c3d-8e4f-5a6b7c8d9e01-ngn",
        "status": "active",
        "updated_at": "2026-09-02T11:21:00Z"
      }
    ]
  },
  "message": "Virtual accounts retrieved successfully",
  "success": true,
  "timestamp": "2026-10-30T09:15:02.481Z"
}

GET

api

virtual-accounts

List virtual accounts

curl --request GET \
  --url https://api.bitnob.com/api/virtual-accounts \
  --header 'X-Auth-Client: <api-key>' \
  --header 'X-Playground-Client-Secret: <api-key>'

const options = {
  method: 'GET',
  headers: {'X-Auth-Client': '<api-key>', 'X-Playground-Client-Secret': '<api-key>'}
};

fetch('https://api.bitnob.com/api/virtual-accounts', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.bitnob.com/api/virtual-accounts"

headers = {
    "X-Auth-Client": "<api-key>",
    "X-Playground-Client-Secret": "<api-key>"
}

response = requests.get(url, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.bitnob.com/api/virtual-accounts",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-Auth-Client: <api-key>",
    "X-Playground-Client-Secret: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.bitnob.com/api/virtual-accounts"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Auth-Client", "<api-key>")
	req.Header.Add("X-Playground-Client-Secret", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "data": {
    "page_info": {
      "has_next_page": false,
      "has_previous_page": false,
      "total": 1
    },
    "virtual_accounts": [
      {
        "account_alias": "Acme Logistics Ltd",
        "account_name": "Acme Logistics Ltd",
        "account_number": "9900000000",
        "account_type": "business",
        "bank_name": "Sandbox Bank",
        "company_id": "019a3b5c-1a2b-7c3d-8e4f-5a6b7c8d9e01",
        "created_at": "2026-09-02T11:21:00Z",
        "currency": "NGN",
        "id": "019a3b5e-0a1b-7c2d-8e3f-4a5b6c7d8e01",
        "reference": "company-va-019a3b5c-1a2b-7c3d-8e4f-5a6b7c8d9e01-ngn",
        "status": "active",
        "updated_at": "2026-09-02T11:21:00Z"
      }
    ]
  },
  "message": "Virtual accounts retrieved successfully",
  "success": true,
  "timestamp": "2026-10-30T09:15:02.481Z"
}

Authorizations

X-Auth-Client

string

header

required

Your workspace client id.

All calls must include four headers:

X-Auth-Client — your workspace client id
X-Auth-Timestamp — Unix seconds
X-Auth-Nonce — 16-byte random hex
X-Auth-Signature — hex(HMAC-SHA256( {client_id}:{timestamp}:{nonce}:{raw_body}, client_secret))

The playground computes the timestamp, nonce and signature for you.

X-Playground-Client-Secret

string

header

required

Your sandbox client secret. The playground uses it to sign the request in your browser and removes it before the request is sent. Never send your client secret as a header in your own integration.

Query Parameters

first

integer

default:20

Page size. Must be positive; values above 100 are capped at 100.

Required range: 1 <= x <= 100

after

string

Opaque cursor from page_info.next_cursor.

Maximum string length: 512

status

enum<string>

Filter by account status.

Available options:

pending,

active,

failed,

suspended,

closed

currency

string

Currency code, case-insensitive.

Example:

"NGN"

account_type

enum<string>

Filter by account type.

Available options:

individual,

business

company_owned

boolean

true returns only the organisation's own accounts (no customer); false only customer accounts. Absent returns all.

Response

Successful responses are wrapped in this envelope, and so are errors a handler answers itself (request body and field validation, some not-found and conflict cases, ORG_NOT_ACTIVE): success is false and error carries a code and message. Errors raised by authentication and by the services behind a handler are a Problem instead.

success

boolean

required

true on success

timestamp

string<date-time>

required

When the response was written.

data

object

The payload; its shape is given per operation. Omitted when there is none.

Show child attributes

error

object

Show child attributes

message

string

Human-readable summary; omitted when empty.

metadata

object

List metadata. Page lists set page, per_page, total and total_pages; offset and cursor lists set limit, offset, has_more and next_cursor. Zero and empty fields are omitted, and metadata is absent when nothing is set.

Show child attributes

request_id

string

Set on error envelopes: the request's correlation id (req_ followed by a UUID), the same value as the X-Correlation-ID response header. Quote it to support.

Get started

Identity

Balances

Customers

Beneficiaries

Addresses

Lightning

LNURL

Nodes

Withdrawals

Transfers

Transactions

Exchange rates

Trading

Payouts

Virtual accounts

Virtual cards

List virtual accounts

Authorizations

Query Parameters

Response